TRANSITION / LOADING
Preparing the next reviewable route and its evidence boundary.
Public boundary. This transition does not request credentials, payment details, or private incident evidence.
FRAMEWORKS / EVIDENCE MAP
Frameworks help teams agree on outcomes, controls, evidence, and priorities. They do not replace scope, ownership, judgment, legal review, or testing.
Applicability is assessed. The right framework depends on jurisdiction, contract, data, service, system boundary, and organizational objective.
// REFERENCE CURRENCY CONTROL
A framework name on a public page is an orientation signal, not a compliance result. Treat the publisher page, contract, jurisdiction, scope, and evidence owner as the source of truth at the start of each engagement.
Version or edition labels describe the reference named for orientation; they are not a promise that the text remains current or applicable.
Each card links to a primary publisher source. Recheck revision history, errata, withdrawal, replacement, and publisher-controlled releases before relying on it.
Primary source labels and URLs were reviewed for this candidate on 2026-09-06; that local review date is not certification, regulator validation, or an assessor opinion.
For EU legal or regulatory references, also confirm national transposition, delegated or implementing acts, effective dates, supervisory guidance, entity designation, and the responsible authority.
For CMMC or defense-contract references, confirm the solicitation or contract clause, FCI/CUI flow, contractor information system boundary, required level, assessment route, flow-down, current DoD guidance, and responsible assessor or authority.
At engagement start, confirm the current text, contract, jurisdiction, system scope, evidence owner, applicable assessor or authority, and required review method.
// STANDARDS LIBRARY
Use this library to frame a conversation, identify evidence, and choose a proportionate next action. Each card links to a primary publisher reference; confirm the current authoritative text and applicability before relying on a requirement.
22 / 22 references shownFILTERS PERSIST IN LINK
Source check: 2026-09-06 / recheck before use
Organize cybersecurity outcomes across Govern, Identify, Protect, Detect, Respond, and Recover.
Boundary: Use it as an outcome and communication layer; it is not itself a certification.
NIST CSF 2.0 resource centerSource check: 2026-09-06 / recheck before use
Frame prepare, categorize, select, implement, assess, authorize, and monitor activities for system and organizational risk.
Boundary: RMF language does not create an authorization to operate, authorizing-official decision, or agency approval.
NIST SP 800-37 Rev. 2Source check: 2026-09-06 / recheck before use
Structure technical security testing, planning, execution, analysis, and reporting.
Boundary: Apply it to an agreed testing scope and rules of engagement.
NIST SP 800-115Source check: 2026-09-06 / recheck before use
Support threat, vulnerability, likelihood, impact, and risk-assessment reasoning.
Boundary: Risk scores require organizational context and evidence quality.
NIST SP 800-30 Rev. 1Source check: 2026-09-06 / recheck before use
Frame contingency planning, recovery priorities, alternate operations, and testing.
Boundary: A plan is not proof of recovery until it is exercised and evidenced.
NIST SP 800-34 Rev. 1Source check: 2026-09-06 / recheck before use
Map security and privacy control families to systems, owners, and evidence.
Boundary: Control presence must be verified in the relevant system and scope.
NIST SP 800-53 Rev. 5Source check: 2026-09-06 / recheck before use
Structure incident-response preparation, handling, coordination, and lessons learned.
Boundary: Incident readiness depends on people, authority, communications, and practice.
NIST SP 800-61 Rev. 3Source check: 2026-09-06 / recheck before use
Assess cyber-supply-chain risk across products, services, dependencies, and suppliers.
Boundary: Vendor questionnaires alone are not sufficient evidence of supplier security.
NIST SP 800-161 Rev. 1Source check: 2026-09-06 / recheck before use
Discuss protection and assessment of controlled unclassified information in applicable nonfederal systems.
Boundary: Applicability, contract language, assessment method, and evidence expectations must be confirmed for each engagement.
NIST CUI publications (SP 800-171/171A Rev. 3)Source check: 2026-09-06 / recheck before use
Frame enhanced CUI requirements and assessment procedures for critical programs and high-value assets when selected by the responsible federal agency.
Boundary: Enhanced CUI requirements are contract- and mission-dependent; this reference does not create a certification, clearance, or federal authorization.
NIST CUI publications (SP 800-172/172A Rev. 3)Source check: 2026-09-06 / recheck before use
Prioritize voluntary, high-impact cybersecurity practices for critical-infrastructure risk reduction and measurable improvement.
Boundary: CPGs are an orientation and prioritization aid, not a universal compliance result, sector designation, or regulator determination.
CISA Cybersecurity Performance GoalsSource check: 2026-09-06 / recheck before use
Frame outcome-based cyber resilience assessment for essential functions, critical infrastructure, and public-sector contexts.
Boundary: CAF alignment is a scoped assessment conversation; it is not an NCSC endorsement, regulatory decision, or certification.
NCSC CAF collectionSource check: 2026-09-06 / recheck before use
Translate common defensive priorities into a practical control improvement sequence.
Boundary: Control adoption should be tied to asset context, ownership, and evidence.
CIS Controls v8.1Source check: 2026-09-06 / recheck before use
Support web, API, and application-security testing conversations and verification.
Boundary: Testing remains authorized, bounded, and appropriate to the application and environment.
OWASP Web Security Testing GuideSource check: 2026-09-06 / recheck before use
Support information-security management, control, risk, and evidence discussions.
Boundary: Readiness support does not create certification or an auditor’s opinion.
ISO/IEC 27001:2022Source check: 2026-09-06 / recheck before use
Frame continuity, risk, impact, decision, and improvement conversations.
Boundary: Business continuity and risk management must reflect the organization’s actual objectives.
ISO 22301:2019Source check: 2026-09-06 / recheck before use
Frame defense-industrial-base questions about FCI/CUI scope, contract requirements, safeguarding evidence, assessment route, and responsible owner.
Boundary: CMMC applicability and required level depend on the solicitation or contract, information type, system boundary, flow-down, and current DoD rules; this page is not a CMMC assessment, certification, C3PAO, DIBCAC, or DoD authorization.
DoD CIO CMMC — AboutSource check: 2026-09-06 / recheck before use
Frame cybersecurity risk-management, incident-reporting, supply-chain, and governance questions for entities that fall within scope.
Boundary: Applicability depends on entity type, size, sector, national transposition, and competent authority; this reference is not a certification or legal determination.
EUR-Lex NIS2 DirectiveSource check: 2026-09-06 / recheck before use
Frame ICT risk management, incident reporting, resilience testing, and ICT third-party risk for applicable financial entities.
Boundary: Financial-sector scope, proportionality, supervisory expectations, and implementation requirements must be confirmed for the specific entity and service.
EUR-Lex DORA RegulationSource check: 2026-09-06 / recheck before use
Frame personal-data security, breach, processor, accountability, and data-governance questions alongside privacy and legal review.
Boundary: GDPR is not a cybersecurity certification; roles, lawful basis, territorial scope, and obligations require the responsible privacy or legal owner.
EUR-Lex GDPRSource check: 2026-09-06 / recheck before use
Frame secure-by-design, vulnerability-handling, product-security, and economic-operator questions for products with digital elements.
Boundary: Product scope, role, exemptions, obligations, and implementation timing require a specialist applicability review; this page is not a conformity assessment.
EUR-Lex Cyber Resilience ActSource check: 2026-09-06 / recheck before use
Frame continuity, physical and cyber resilience, dependency, incident, and recovery questions for critical entities that fall within scope.
Boundary: Entity designation, sector, national implementation, risk measures, and competent-authority expectations must be confirmed; this is not a resilience designation or legal opinion.
EUR-Lex Critical Entities Resilience Directive// SERVICE / FRAMEWORK FIT
This orientation map connects each service question to candidate reference families. It is not a formal crosswalk, audit plan, certification route, legal interpretation, or evidence of compliance.
| Service question | Candidate reference families | Applicability question | Applicability record | Boundary |
|---|---|---|---|---|
| Authorized penetration testing | Is the proposed test scope, authority, method, and evidence path proportionate? |
| Testing guidance does not grant authorization or prove that a system is secure. | |
| Vulnerability assessment | How will an observed weakness become context, priority, ownership, and treatment? |
| A scanner result or control list is not, by itself, a validated finding or risk-acceptance decision. | |
| Cyber risk management | What outcomes, risk criteria, evidence quality, and decision owner apply? |
| A reference family is not a universal score, board decision, or residual-risk acceptance. | |
| Technical due diligence | Which architecture, control, dependency, product, data, or delivery questions could change the material decision? |
| Reference alignment is not independent assurance and does not create a legal, financial, investment, or procurement verdict. | |
| Vendor due diligence | Does the supplier evidence fit the service, data, access, incident, concentration, exit, and applicable contract or regulatory relationship? |
| A questionnaire or reference map is not supplier assurance, a CMMC status, a regulatory determination, or a procurement decision. | |
| Government and defense readiness |
| Which mission, solicitation or contract, FCI/CUI boundary, system boundary, required level, assessment route, critical-entity context, and authorizing role define the actual requirement? |
| Reference alignment is not an authorization to operate, CMMC status, clearance, contract award, critical-entity designation, or government approval. |
| Compliance readiness |
| Which requirement applies, what evidence is expected, which legal, contracting, or supervisory role is relevant, and who owns the control or exception? |
| Readiness mapping is not certification, accreditation, clearance, CMMC status, legal advice, conformity assessment, or regulator approval. |
| Disaster recovery and BCP | What critical service, dependencies, recovery assumptions, regulatory context, and exercise evidence determine continuity? |
| A plan, directive, or framework does not prove recovery until the relevant capability is exercised and evidenced. | |
| Incident readiness |
| What roles, decisions, communications, evidence boundaries, reporting duties, and lessons must be practiced? |
| A readiness exercise is not live incident response, attribution, a breach notification decision, or a regulator determination. |
// PROCUREMENT / GOVERNANCE
Government and defense-supplier work is strongest when the requirement, evidence, authority, and decision owner are visible before technical activity begins.
Confirm the jurisdiction, contract, data category, system boundary, and responsible authority.
Map the requirement to evidence, owner, implementation state, and review date.
Record what the control or framework does not prove.
Separate technical readiness from certification, accreditation, legal advice, or procurement approval.
// CLAIMS CONTROL
ZeroDev can help structure evidence, identify gaps, plan remediation, and prepare questions for an appropriate assessor, auditor, legal adviser, procurement owner, or authority. The site does not claim certification, accreditation, government approval, security clearance, or formal compliance without exact evidence.
// NEXT MOVE
Start with the requirement, the system, or the risk decision. Do not send secrets or sensitive evidence through ordinary email.
Review assurance boundaries